Re: [PATCH 1/2] crypto: x86 - remove aegis128 support

[Eric Biggers <ebiggers@kernel.org>]

On Thu, Nov 12, 2026 at 05:44:17PM +0100, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb@kernel.org>
> 
> Even the people that are invested in Aegis appear to have lost interest
> in aegis128: it did win the CAESAR competition but is no longer covered
> by RFC 10032, which does list some other variants that competed as well.
> 
> So let's delete it.
> 
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>

AEGIS-128 might be used by dm-crypt, e.g. if anyone passed
'-c aegis128-random' to cryptsetup.  I added dm-devel and Milan Broz to
Cc to comment on the feasibility of removing it.

But clearly AEGIS-128 is a mistake.  It has a hardcoded amount of
parallelism that is much too small for current CPUs.  That was very
clear when I looked into optimizing it with AVX-512: it just does not
work, and it uses only a quarter of the CPU's resources.

That's resulted in AES-GCM now being much faster, as well as the people
promoting AEGIS having abandoned AEGIS-128 and now advocating entirely
for other variants like AEGIS-128X4 instead (despite that unfortunately
still having a hardcoded amount of parallelism).

AEGIS-128 doesn't fare super well on the nonce front either, with it not
being nonce-misuse-resistant, and its 128-bit nonce being only an
incremental upgrade over AES-GCM's 96-bit nonce.  (Compare to
XChaCha20Poly1305's or XAES-256-GCM's 192-bit nonce, or to AES-GCM-SIV
which is nonce-misuse-resistant.)

So yes, this seems to have become yet another odd legacy thing that
doesn't really make sense to use.  If anyone does use it, it is likely
mainly because the kernel's existing, already-highly-optimized
XChaCha20Poly1305 code hasn't yet been wired up to dm-crypt, or because
they relied on outdated information about AEGIS-128's performance.

- Eric